The user can just edit the wg conf file and remove the restriction where it can and cannot connect to.
The file is not a baked immutable binary

Yes. Split-tunneling…
But if you are really hardcore about restrictions and would need to update the profiles it will be a pita…
Scheduling stuff is annoying ;-;

Only if you have duplicates.

Agreed.
Secure it properly and you wont be pwned instantly.
My setup:
WAN -> OPNsense -> CrowdSec on FW and docker server -> Traefik -> Authelia middleware -> Jellyfin.

I also have a geoblock active on the Cloudflare domain and directly on my opnsense.
Most datacenter ASNs are also blocked. They don’t need to connect to me.

Yes, first party apps are broken but the browser works good enough and if I meed it, I have a VPN for myself.
Relatives get web browser or I’ll consider a S2S VPN setup.

Issue:
Most clients we instruct on homeoffice usage with vpns are already unable to remember the workflow: VPN -> (wait until green for connected) -> open work app -> Do work -> close work app -> disconnect vpn.

Now you also may not want to tunnel all traffic (if you don’t have a VPS with symmetric Gbit and unlimited traffic) so you’d need to set up split-tunneling and/or limit the apps allowed for the tunnel (works in android).

Honestly? It would be easier to set up a S2S split-tunnel VPN with wireguard on the relatives router.

Very cool. Thanks for the pictures!

How are you doing HA? Have you passed through the NIC or are you just doing a NIC bridge (or whatever networking proxmox offers)?

Very complicated problem to have?
I just back mine up via Veeam. The VM is running on proxmox.

Ty :)

20$ SSD…
That were the times man…

I’d say it depends on your interests.
But generally the kinds of inspecting someone elses work is usually entertaining in the profession you work in.

That comes (IMO and just based on what I read on the internet) in every profession and job that has somewhat direct contact with a customer/client.

Example from mine:
Customer is a doctor.
Customer fucked a thing up and instead of asking us (MSP and supporter of his documentation software), they tried to restore the database from their backup software (which we also support) by themself.
(Side note: We can support it but customer has no maintenance contract)
Customer fucks the restore up and the database doesnt come up again.
We tried to to restore it -> No dice. Backup disk not readable.
I investigate the disk -> sector errors. On top it’s formatted as exFAT.
(Side note: The other disk (2 in total) had data from >20 days ago at the time of issue. So in total he was about to loose 20 days of patient history)
I painstakingly clone the disk and somehow get it to a working state in which Windows doesnt lock up.
Together with the support of the backup software I was able to extract the media and patient history DB from backup.
Now my boss is working on restoring the database to a working state.

Thing is: This happened before.
Boss said last time the customer got help from a patient that has IT knowledge (lol). This time it was a relative (double lol).
If the relative won’t be disowned, idk really ¯\_(ツ)_/¯

May I ask what that job entails?
Like the presenter after/before the news or compiling the data for the presenter?

My job actually falls within that: Sysadmin at an MSP.

May I ask with what you initiate the connection?
Are you using some kind of STUN server/service?

The german router “FritzBox” recently did implement this.
A very rudimentary version of it but still.

No I mean why would the attacker even attempt to attack your outside if they can just figure out what sits behind it, follow it through the NAT and then exploit it from there.

Same energy:
https://youtu.be/Jpuqmjd12lg

Title: I Got My Own AS Number. Here’s: What It Took

I skimmed over your posted blog. Reads like a somewhat same process.

Literally “Same, same but different” ^^

  jellyfin:
    container_name: jellyfin
    image: linuxserver/jellyfin:amd64-version-12.1ubu2604
    expose:
      - 8096
    networks:
      - media
    volumes:
      - ${DIR_LOCALTIME}:/etc/localtime:ro
      - ${DIR_container}/jellyfin/config:/config
      - ${DIR_media}/data:/media/data
    devices:
      # IntelQuickSync für TigerLake GT2 [Iris Xe Graphics]
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    environment:
      PUID: 1200
      PGID: 1300
      #UMASK: 022
      TZ: ${TZ}
      DOCKER_MODS: linuxserver/mods:jellyfin-opencl-intel
      JELLYFIN_PublishedServerUrl: "https://jellyfin/.$%7BDOMAIN_EXTERNAL%7D"
    deploy:
      resources:
        limits:
          memory: 10G
    group_add:
      - '44'
      - '992'
    labels:
      # Traefik:
      traefik.enable: true # Enable Traefik reverse proxy for the Traefik dashboard.
      traefik.http.services.jellyfin.loadbalancer.server.port: 8096
      traefik.http.routers.jellyfin-public.entrypoints: 'https'
      traefik.http.routers.jellyfin-public.rule: 'Host(`jellyfin.${DOMAIN_EXTERNAL}`)'
      # Secondary domain
      traefik.http.routers.jellyfin-public2.entrypoints: 'https'
      traefik.http.routers.jellyfin-public2.rule: 'Host(`jellyfin.${DOMAIN_EXTERNAL2}`)'
    restart: unless-stopped

Afaik the card0 is only used for rendering to a desktop/monitor and for this purpose you should actually use the renderD128 path.
But not sure either about this stuff. Sort of works for me. At least intel_gpu_top shows activity when transcoding :p

Why should they take over the outer router if they can just take over the destination they were routed to?